WEBMCP AUDIT REPORT

https://peps-portfolio.vercel.app/

scanned2026-11-09T15:14:58.257Z
rulepackrulepack-2026.10.1
scannerwebmcp-scanner/0.3.0
tools4
$ node scanner/bin/webmcp-scan.js https://peps-portfolio.vercel.app/
live Live

Visible to real users: tools are registered through the native, flag-free WebMCP API. Any capable agent visiting this page today can see and call them.

A
security grade from deterministic rules only
0critical
0high
0medium
0low
2info

Origin trial tokens

kindfeatureoriginexpirysubdomainorigin matchesstatus
header WebMCP https://peps-portfolio.vercel.app:443 2027-03-30T00:00:00.000Z no no valid

Agent readiness: 6 of 12 checks pass

Can an AI agent find, open and understand this page? These checks read robots.txt, llms.txt, the sitemap, security.txt and the page's own metadata. They never affect the security grade; each one links to its fix and to the vendor document it rests on.

statuscheckevidencefinding
pass Page opens for a bot HTTP 200, "Christian Peps Caasi | Developer Portfolio"
info robots.txt present HTTP 404 (allow-all by default) site.robots-missing
n/a Page allowed for every crawler no robots.txt
n/a On-demand assistant fetchers allowed no robots.txt
n/a AI search crawlers allowed no robots.txt
n/a Training crawlers no robots.txt
n/a AI usage policy stated no robots.txt
warn Sitemap reachable HTTP 404 site.sitemap-missing
n/a Sitemap declared in robots.txt no robots.txt
info llms.txt HTTP 404 site.llms-txt-missing
info security.txt (RFC 9116) HTTP 404 site.security-txt-missing
n/a MCP: AI Catalog and Server Card no AI Catalog: no MCP server advertised
n/a MCP in llms.txt no MCP server advertised
pass Indexable (no noindex) no restricting directive
pass <title> present "Christian Peps Caasi | Developer Portfolio"
pass Meta description present 116 chars
info Canonical URL declared missing site.canonical-missing
info Structured data (JSON-LD) none site.structured-data-missing
pass Open Graph preview Christian Peps Caasi | Developer Portfolio, no image
pass Document language en

Coverage

techniquestatustimeevidence
Native, flag offcomplete6111 ms1 frame(s), 4 tool(s)
Native, flag forced oncomplete5966 ms1 frame(s), 4 tool(s)
Document-start capture hookcomplete5950 ms1 frame(s), 4 tool(s)

No explicit Permissions-Policy: tools=… directive was observed; the specification default is self.

Tools

nametitledescriptionoriginsourceannotationsschema props
find_projects Find portfolio projects, optionally filtering by category and/or technology. https://peps-portfolio.vercel.app native readOnlyHint: true untrustedContentHint: false 2
get_project_details Get the public details and links for one portfolio project by its exact ID. https://peps-portfolio.vercel.app native readOnlyHint: true untrustedContentHint: false 1
search_weekly_logs Search public weekly OJT logs by a case-insensitive phrase across titles, summaries, tasks, learnings, and tags. Optionally filter by exact tag. With no filters… https://peps-portfolio.vercel.app native readOnlyHint: true untrustedContentHint: false 2
get_weekly_log_details Get one public weekly OJT log by exact slug, including tasks, learnings, tags, and adjacent week slugs. https://peps-portfolio.vercel.app native readOnlyHint: true untrustedContentHint: false 1

Findings

RECOMMENDED 2

INFO RECOMMENDED deterministic
schema.no-required

Schema has properties but no required list

Tool "find_projects"'s inputSchema declares properties but no `required` array. Opinion: most tools have at least one mandatory argument; an empty required list often just means the author never filled it in.

tool find_projects · field inputSchema.required
(absent)
$ mcpaudit-webmcp-scan --url 'https://peps-portfolio.vercel.app/' --check schema.no-required
How to fix

List the arguments the tool cannot run without.

required: ["query"]
full explanation of schema.no-required
INFO RECOMMENDED deterministic
schema.no-required

Schema has properties but no required list

Tool "search_weekly_logs"'s inputSchema declares properties but no `required` array. Opinion: most tools have at least one mandatory argument; an empty required list often just means the author never filled it in.

tool search_weekly_logs · field inputSchema.required
(absent)
$ mcpaudit-webmcp-scan --url 'https://peps-portfolio.vercel.app/' --check schema.no-required
How to fix

List the arguments the tool cannot run without.

required: ["query"]
full explanation of schema.no-required

READINESS 6

INFO READINESS deterministic
site.robots-missing

No robots.txt

Crawlers treat a missing robots.txt as "crawl everything", so nothing is blocked, but the site also states no policy and declares no sitemap.

How to fix

Add a robots.txt at the site root that allows crawling, names the sitemap, and states your AI policy with a Content-Signal line.

User-agent: *
Allow: /
Content-Signal: search=yes, ai-input=yes
Sitemap: https://example.com/sitemap.xml
full explanation of site.robots-missing
LOW READINESS deterministic
site.sitemap-missing

No sitemap found

https://peps-portfolio.vercel.app/sitemap.xml answered HTTP 404. A sitemap is how crawlers learn every URL without guessing; llms.txt covers the same ground for agents.

https://peps-portfolio.vercel.app/sitemap.xml
How to fix

Generate a sitemap.xml listing every public URL and declare it in robots.txt.

<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url><loc>https://example.com/</loc></url>
</urlset>
full explanation of site.sitemap-missing
INFO READINESS deterministic
site.llms-txt-missing

No llms.txt

Optional but cheap: a short markdown index of what the site is and which pages matter, read by coding agents and assistants and audited by Chrome Lighthouse. Google Search ignores it (neither helps nor harms ranking).

How to fix

Add /llms.txt: an H1 with the site name, a one-line blockquote summary, then H2 sections of markdown links to the pages an agent should read. Google Search ignores the file (neither helps nor harms ranking); Chrome Lighthouse audits for it.

# Jane Doe

> Senior backend engineer (Go, Postgres), Berlin. CV, projects and contact.

## CV
- [Resume](https://example.com/cv.md): experience and skills

## Projects
- [Project A](https://example.com/projects/a.md): what it is and why it matters
full explanation of site.llms-txt-missing
INFO READINESS deterministic
site.structured-data-missing

No schema.org structured data

JSON-LD is how a page says, machine-readably, "this is a Person, this is an Organization, this is an Article". Google documents it as the way to give explicit clues about a page's meaning; agents read the same block.

How to fix

Add a JSON-LD block that names the entity the page is about (Person, Organization, Article, Product).

<script type="application/ld+json">{"@context":"https://schema.org","@type":"Person","name":"Jane Doe","jobTitle":"Backend engineer","url":"https://example.com/"}</script>
full explanation of site.structured-data-missing

Registering your own tools?

Start from a config the checks above already pass.

Build your own WebMCP config

Need a detailed audit?

On request we run a detailed MCP audit and prepare everything you need: findings, fixes and ready configs.

Order an audit

This is an automated, point-in-time report from three browser observations of the page: native without a forced flag, native with the experimental feature forced on, and a document-start registration capture. No tool or declarative form was executed, no account was used, and hidden or interaction-only states may not be represented. Agent-readiness checks fetch robots.txt, llms.txt, the sitemap, security.txt and the AI Catalog once each and never affect the grade. The grade, when shown, reflects deterministic checks only and is not a certification. Job 6b48e9f383bed01a. Rulepack rulepack-2026.10.1.